Security and cryptography roundup for 2026-10-20

Post-quantum signature research and multiple Apache and Perl disclosures led security traffic on 2026-10-20. An AI-assisted audit claimed practical breaks on twenty ePrint schemes, while CVEs covered Arrow Parquet KMS handling, Camel JGroups deserialization, Airflow SAML login, and two Perl modules.

AI-assisted audit reports practical breaks on twenty ePrint signature schemes

Participants on the pqc-forum described an AI-driven audit that found and verified practical attacks against twenty signature schemes posted to ePrint, exercised at full parameter sets. The work targets designs that had not previously been shown broken in practice. Implementers and evaluators of post-quantum signatures have concrete reason to discount unvetted ePrint candidates until independent review catches up.

Apache Arrow and PyArrow pass unvalidated Parquet KMS URLs to pluggable clients

Apache Arrow C++ and PyArrow published CVE-2026-92287, a moderate-severity flaw in which a Parquet file can supply a KMS URL that is forwarded to a pluggable KmsClient without host validation. An attacker controlling encrypted Parquet input can redirect key-management requests. Operators of Parquet decryption pipelines should update and constrain KmsClient behavior.

Fifteen CVEs disclosed in Cpanel::JSON::XS before 4.80

A single oss-security report listed fifteen CVEs in the Cpanel::JSON::XS Perl module for versions before 4.80. The flaws include information leaks, resource exhaustion, and parsing defects. Applications that feed untrusted JSON to this module should move to a fixed release.

High-severity RCE via Java deserialization in Apache Camel JGroups

Apache Camel announced CVE-2026-88900 affecting the Camel-JGroups component. Unauthenticated, unsafe Java deserialization of cluster messages can yield remote code execution. Multiple 4.x releases are in scope, so deployments that rely on JGroups clustering need the patched packages.

SAML CSRF lets attackers log Airflow users into attacker accounts

CVE-2026-86467 covers the Apache Airflow Amazon provider AWS auth manager. Missing InResponseTo validation on SAML login enables a CSRF attack that authenticates the victim into an account chosen by the attacker. Sites using this SAML path should upgrade the provider.

Brief exchange on modulus reuse across ML-KEM and ML-DSA levels

A two-message pqc-forum thread asked whether a uniform modulus across ML-KEM and ML-DSA security levels is optimal and floated independent parameter tuning. The discussion is exploratory and does not alter current standardized parameter sets.

Plack::Middleware::ETag leaks inode numbers in default ETags

CVE-2026-111946 notes that Plack::Middleware::ETag versions from 0.04 before 0.06 embed file inode numbers in the default ETag header. The exposure is limited but can aid host fingerprinting. Perl Plack users can move to 0.06.